WP Manifestindependent plugin directory
manifest / editor / action-hook-block

Action Hook Block WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

WordPress plugin adding "Action hook" block functionality.

★ 2stars
12release downloads
1.1.0latest · 3 years ago

Install

Download action-hook-block.zip From the 1.1.0 release on GitHub, Sep 7, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/webmandesign/action-hook-block/releases/download/1.1.0/action-hook-block.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A block providing WordPress PHP action hook execution on front-end.

Description

A block providing WordPress PHP action hook execution on front-end of your website.

Is this for non-techie user?

No, probably not.

You need to know how to use WordPress action hooks to your advantage to be able to gain from this plugin and from Action hook block.

The plugin helps with execution of your PHP code, so coding knowledge is required.

What problem does it solve?

❓ Do you want to execute PHP code in the page or post content? ❓ Do you want to display some additional content on search results page depending on specific search condition? ❓ Do you want to conditionally display some information in a sidebar depending on a condition? ❓ Do you want to output your functionality, but there is no block for that?

Action Hook Block plugin provides Action hook block solving these cases!

The Action hook block allows you to select a predefined action hook to execute at the specific place on your website front-end. You can then hook your PHP function onto such action via your theme's functions.php file, for example.

By default, plugin provides hooks of Theme Hook Alliance project. (There is a 3rd party helper plugin for Theme Hook Alliance hooks too.)

You can disable support for Theme Hook Alliance and add your own hook names in theme options.

Got a question or suggestion?

In case of any question or suggestion regarding this plugin, feel free to ask at support section, or at GitHub repository issues.

Installation

  1. Unzip the plugin download file and upload action-hook-block folder into the /wp-content/plugins/ directory.
  2. Activate the plugin through the "Plugins" menu in WordPress.
  3. Plugin works immediately after activation by adding new "Action hook" block into your WordPress block editor. You can customize plugin options on Settings → Writing screen.

Frequently Asked Questions

How does it work?

  1. Insert an Action hook block into your page/post content (or into Site Editor) where you want to execute your PHP code.
  2. Select an action hook name to be executed at the place.
  3. Save the post/page/Site Editor.
  4. In your theme's functions.php file add your PHP code to execute, such as: add_action( 'action_hook_name_here', function() { echo 'Hello world!'; } );
  5. Watch your code appear on your website front-end.

What is Theme Hook Alliance (THA)?

Theme Hook Alliance (THA) is set of predefined action hook names used in specific places in themes. For more information about this project visit its GitHub repository.

Although the project is old, there is really nothing to update or change in it. It simply works as intended since its first design and release.

You can use additional 3rd party plugin to execute your code when using THA hooks.

What is a "context" option?

Can I add custom hooks?

Can I integrate this with my theme?

Screenshots

  1. Preview of the block functionality

Changelog

Please see the changelog.md file for details.

Upgrade Notice

1.1.0

Updating block API version.

1.0.0

Initial release.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Sep 7, 2023 3 years ago
action-hook-block.zip
9
Mar 23, 2023 3 years ago
action-hook-block.1.0.0.zip
3
B grade

Security

Action Hook Block 1.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.0
Findings
1
Worst severity
medium
Content hash
92874da124b50013d3fba105…

Findings

  • medium Arbitrary do_action from block attributes without runtime whitelist

    eval_by_design

    Block::render() executes do_action(trim($atts['name']), ...) without verifying the hook name is in the admin-configured/THA allow-list from Hooks::get(). The editor UI presents a select list, but post content can store any name. Any role that can publish posts can place a block that fires arbitrary WordPress actions on every front-end view.

    includes/Block.php:119-149

    Recommendation

    At render time, allow only hook names present in Hooks::get() (or a hard-coded safe list). Reject unknown names.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.